IT & Microsoft cloud for insurance

For a broker that usually means being specific about a handful of services rather than the IT estate as a whole. Placing cover, handling a claim notification, taking a premium payment, and giving clients access to their documents each have different tolerances. A claims line that is unavailable for a day during a weather event is a materially different problem from a document portal being slow, and treating them identically produces a plan that is both expensive and imprecise.

The evidence part is what most firms underestimate. An impact tolerance you have never tested is an assertion. Testing it means actually rehearsing a scenario, recording how long recovery took, and being honest when the answer exceeds the tolerance you set, then either improving the recovery or revising the tolerance for a defensible reason. Third parties are in scope too, so a software house or insurer platform your service depends on is part of the picture, not an excuse outside it.

The technical defences that matter most are the ones that prevent mailbox takeover and detect it quickly: multi-factor authentication without exceptions, conditional access that questions sign-ins that do not fit the normal pattern, and alerting on the tell-tale signs of a compromised account, particularly inbox rules that quietly move or delete messages so the real owner never sees the thread the attacker is running. Anti-impersonation controls then catch the lookalike-domain variant, where the attacker cannot get into a mailbox and registers something one character different instead.

The process defence is a rule about payment changes: bank details are never amended on the strength of an email, and any change is verified by phone to a number already on file. It is unglamorous and it is what actually stops the loss.

Mailboxes alone are not a reliable archive. People delete things, leavers' mailboxes get removed, retention gets applied inconsistently, and a compromised account can have its contents altered. An independent archive captures messages as they are sent and received, keeps them tamper-evident for a defined retention period, and stays searchable regardless of what has happened to the original mailbox since.

Search quality matters as much as retention. An archive that technically holds seven years of mail but takes days to produce a specific thread has not solved the problem it was bought for, so the practical test is how quickly you can produce every message relating to one client across the full period.

Cyber Essentials, or Cyber Essentials Plus where a partner specifies it, answers a large share of this in a form the other side already recognises. That is its practical value here: rather than negotiating over bespoke evidence, you point to an externally assessed baseline. Where a partner asks specifically for the audited version, self-assessment will not satisfy them, so it is worth reading the requirement carefully before certifying.

The remaining questions usually concern process rather than technology, and they are the ones worth preparing in advance: who has access to client data and how that is reviewed, what happens on the day someone leaves, how an incident would be detected and who would be told, and within what timeframe. Firms that have written these down once answer consistently and quickly; firms that have not tend to answer differently each time, which invites more scrutiny rather than less.

Then find out what was done rather than only what was read. Check for inbox rules the user did not create, particularly ones that forward, move or delete messages, because those are how an attacker keeps a conversation hidden from its real owner. Check for forwarding at the mailbox level, added devices or authentication methods, and any changes to trusted sign-in settings. Removing the attacker's access without removing their persistence means they return.

In parallel, warn the people at risk. If the account handles premium or claims payments, tell clients and counterparties not to act on payment instructions from that mailbox until told otherwise, using a channel other than the compromised email. Money moved during an incident is very difficult to recover, and the window for a bank to intervene is short.

Then handle the obligations, which for a regulated firm are real and time-bound. Assess whether personal data was accessible, since that drives whether the ICO must be notified within 72 hours, consider your FCA reporting obligations, and involve your cyber insurer early, because policies frequently require notification before you engage anyone to help. Deciding all of this during the incident is how firms miss deadlines, which is the argument for having the runbook written and the numbers to hand beforehand.